(#3281) Add validation for cache folder permissions #3282
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description Of Changes
These changes introduces a new validation check to ensure that
the system cache folder that is used for storing NuGet responses
have been properly locked down to administrators.
When the directory exists, and allows modifications or creations of
files by normal user this will output a validation warning about steps
that can be taken to lock down the directory.
When the directory does not exist, this same validation check ensure
that the directory is created while only allowing Administrators to
modify, create or delete anything in the folder.
Motivation and Context
We should do what we can to prevent malicious users to make modifications to something that can have reporcussions for the user that is installing a package.
Testing
Elevated tests
C:\ProgramData\ChocolateyHttpCache
and delete any log fileschoco search vcredist140
C:\ProgramData\ChocolateyHttpCache
and log filechoco search vcredist140
choco search vcredist140
againNon-Elevated tests
C:\Users\<USERNAME>\.chocolatey\http-cache
and recreate folderC:\ProgramData\ChocolateyHttpCache
choco search vcredist140 —debug
C:\Users\<USERNAME>\.chocolatey\http-cache
Operating Systems Testing
Change Types Made
Change Checklist
Related Issue
Fixes #3281